Commit 3c3736cd authored by Suzuki K Poulose's avatar Suzuki K Poulose Committed by Marc Zyngier
Browse files

KVM: arm/arm64: Fix handling of stage2 huge mappings 



We rely on the mmu_notifier call backs to handle the split/merge
of huge pages and thus we are guaranteed that, while creating a
block mapping, either the entire block is unmapped at stage2 or it
is missing permission.

However, we miss a case where the block mapping is split for dirty
logging case and then could later be made block mapping, if we cancel the
dirty logging. This not only creates inconsistent TLB entries for
the pages in the the block, but also leakes the table pages for
PMD level.

Handle this corner case for the huge mappings at stage2 by
unmapping the non-huge mapping for the block. This could potentially
release the upper level table. So we need to restart the table walk
once we unmap the range.

Fixes : ad361f09 ("KVM: ARM: Support hugetlbfs backed huge pages")
Reported-by: default avatarZheng Xiang <zhengxiang9@huawei.com>
Cc: Zheng Xiang <zhengxiang9@huawei.com>
Cc: Zenghui Yu <yuzenghui@huawei.com>
Cc: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
parent a80868f3

arch/arm/include/asm/stage2_pgtable.h

+2 −0
Original line number Diff line number Diff line
@@ -75,6 +75,8 @@ static inline bool kvm_stage2_has_pud(struct kvm *kvm) 


#define S2_PMD_MASK				PMD_MASK

#define S2_PMD_SIZE				PMD_SIZE

#define S2_PUD_MASK				PUD_MASK

#define S2_PUD_SIZE				PUD_SIZE



static inline bool kvm_stage2_has_pmd(struct kvm *kvm)

{

virt/kvm/arm/mmu.c

+43 −16
Original line number Diff line number Diff line
@@ -1067,11 +1067,11 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache 
{

	pmd_t *pmd, old_pmd;



retry:

	pmd = stage2_get_pmd(kvm, cache, addr);

	VM_BUG_ON(!pmd);



	old_pmd = *pmd;

	if (pmd_present(old_pmd)) {

	/*

	 * Multiple vcpus faulting on the same PMD entry, can

	 * lead to them sequentially updating the PMD with the
@@ -1086,6 +1086,24 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache 
	if (pmd_val(old_pmd) == pmd_val(*new_pmd))

		return 0;



	if (pmd_present(old_pmd)) {

		/*

		 * If we already have PTE level mapping for this block,

		 * we must unmap it to avoid inconsistent TLB state and

		 * leaking the table page. We could end up in this situation

		 * if the memory slot was marked for dirty logging and was

		 * reverted, leaving PTE level mappings for the pages accessed

		 * during the period. So, unmap the PTE level mapping for this

		 * block and retry, as we could have released the upper level

		 * table in the process.

		 *

		 * Normal THP split/merge follows mmu_notifier callbacks and do

		 * get handled accordingly.

		 */

		if (!pmd_thp_or_huge(old_pmd)) {

			unmap_stage2_range(kvm, addr & S2_PMD_MASK, S2_PMD_SIZE);

			goto retry;

		}

		/*

		 * Mapping in huge pages should only happen through a

		 * fault.  If a page is merged into a transparent huge
@@ -1097,8 +1115,7 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache 
		 * should become splitting first, unmapped, merged,

		 * and mapped back in on-demand.

		 */

		VM_BUG_ON(pmd_pfn(old_pmd) != pmd_pfn(*new_pmd));



		WARN_ON_ONCE(pmd_pfn(old_pmd) != pmd_pfn(*new_pmd));

		pmd_clear(pmd);

		kvm_tlb_flush_vmid_ipa(kvm, addr);

	} else {
@@ -1114,6 +1131,7 @@ static int stage2_set_pud_huge(struct kvm *kvm, struct kvm_mmu_memory_cache *cac 
{

	pud_t *pudp, old_pud;



retry:

	pudp = stage2_get_pud(kvm, cache, addr);

	VM_BUG_ON(!pudp);
@@ -1121,14 +1139,23 @@ static int stage2_set_pud_huge(struct kvm *kvm, struct kvm_mmu_memory_cache *cac 


	/*

	 * A large number of vcpus faulting on the same stage 2 entry,

	 * can lead to a refault due to the

	 * stage2_pud_clear()/tlb_flush(). Skip updating the page

	 * tables if there is no change.

	 * can lead to a refault due to the stage2_pud_clear()/tlb_flush().

	 * Skip updating the page tables if there is no change.

	 */

	if (pud_val(old_pud) == pud_val(*new_pudp))

		return 0;



	if (stage2_pud_present(kvm, old_pud)) {

		/*

		 * If we already have table level mapping for this block, unmap

		 * the range for this block and retry.

		 */

		if (!stage2_pud_huge(kvm, old_pud)) {

			unmap_stage2_range(kvm, addr & S2_PUD_MASK, S2_PUD_SIZE);

			goto retry;

		}



		WARN_ON_ONCE(kvm_pud_pfn(old_pud) != kvm_pud_pfn(*new_pudp));

		stage2_pud_clear(kvm, pudp);

		kvm_tlb_flush_vmid_ipa(kvm, addr);

	} else {

CRA Git | Maintained and supported by SUSTech CRA and CCSE